The flaw lies in the Administrative Repair Handler’s file server/methods/fixDuplicateLists.js, allowing remote actors to manipulate the system in a way that bypasses intended access controls. Because the authentication checks are not enforced properly, an attacker can invoke administrative functions without proper privileges, effectively achieving an unauthorized elevation of privileges. The problem is classified as CWE‑266 and CWE‑284, which describe permissions‑related weaknesses.

WeKan from the project is affected, with all releases up to and including 8.20 potentially vulnerable. The fix arrives in version 8.21, which replaces or patches the problematic code. No other versions are listed as affected in the advisories.

The CVSS score of 5.3 reflects a moderate risk, while the EPSS score of under 1 % indicates a very low probability of exploitation in the wild. The vulnerability is not cataloged by CISA’s KEV list. Exploitation would require remote access to the application’s endpoints, and the attacker can trigger the flaw by sending crafted requests to the Administrative Repair Handler before the patch is applied.